deploy.yml

name: Deploy

# Builds the site of plugins.nginxui.com with scripts/build-catalog.mjs and
# deploys it to Cloudflare Pages. Nothing it builds is committed: the releases
# come from the GitHub Releases of every plugin, and the published catalog
# pins the packages of the releases it already lists.
#
# Runs on a change of main, every hour, and by hand. The release webhook in
# worker/ runs it by hand as soon as a listed plugin releases. A scheduled run
# that builds the same catalog and keyring as the published ones deploys
# nothing. When the change lists a submitted plugin (submit-issue.yml), the
# deploy comments the plugin page on the submission issue, labels it "listed"
# and closes it. A name a listing does not show yet goes to the maintainers on
# the issue of its plugin (scripts/ci/name-review.mjs, review-names.yml).
#
# Secrets: CLOUDFLARE_API_TOKEN (Pages edit) and CLOUDFLARE_ACCOUNT_ID of the
# "cloudflare" environment, and the organization PLUGIN_SIGNING_KEY that
# signs v1/partners.json. Variables:
# CLOUDFLARE_PAGES_PROJECT (default nginx-ui-plugins), CATALOG_URL (default
# https://plugins.nginxui.com) and PLUGIN_SIGNING_PUBLIC_KEY.
on:
  push:
    branches: [main]
  schedule:
    - cron: "23 * * * *"
  workflow_dispatch:
    inputs:
      first_deploy:
        description: Build without a published catalog, refused once the site serves one
        type: boolean
        default: false
      repin:
        description: Listed releases rebuilt on purpose, as <id>@<version> separated by spaces, to verify and pin anew
        type: string
        default: ""

permissions:
  contents: read

env:
  PLUGIN_SPEC_DIR: ${{ github.workspace }}/.plugin-spec

concurrency:
  group: deploy
  cancel-in-progress: false

jobs:
  deploy:
    if: github.ref == 'refs/heads/main'
    runs-on: ubuntu-latest
    # Holds CLOUDFLARE_API_TOKEN and CLOUDFLARE_ACCOUNT_ID.
    environment: cloudflare
    permissions:
      contents: read
      issues: write
    steps:
      - uses: actions/checkout@v7
        with:
          # build-partners.mjs reads the time of the last partners/ change.
          fetch-depth: 0

      - uses: actions/setup-node@v7
        with:
          node-version: "22"

      # The catalog and keyring schemas live in the contract repository.
      - uses: actions/checkout@v7
        with:
          repository: nginxui/plugin-spec
          path: .plugin-spec

      - run: node --test scripts/ci/*.test.mjs scripts/submission/*.test.mjs

      - run: node scripts/validate.mjs

      # Releases that were left out, so the hourly build does not read them
      # again until the release or the keys change. A cache entry is
      # immutable: the newest one is restored, and a new one is saved only
      # when the content changed.
      - id: failures
        uses: actions/cache/restore@v6
        with:
          path: .cache/verify-failures.json
          key: verify-failures-
          restore-keys: verify-failures-

      - id: build
        name: Build the site
        env:
          GITHUB_TOKEN: ${{ github.token }}
          CATALOG_URL: ${{ vars.CATALOG_URL }}
          PLUGIN_SIGNING_PUBLIC_KEY: ${{ vars.PLUGIN_SIGNING_PUBLIC_KEY }}
          FIRST_DEPLOY: ${{ inputs.first_deploy }}
          REPIN: ${{ inputs.repin }}
        run: |
          args=(--out dist --failures .cache/verify-failures.json --pending pending-names.json)
          if [ "${FIRST_DEPLOY}" = "true" ]; then
            args+=(--first-deploy)
          fi
          for release in ${REPIN}; do
            args+=(--repin "${release}")
          done
          node scripts/build-catalog.mjs "${args[@]}"

      - id: failures-key
        if: always()
        run: |
          if [ -f .cache/verify-failures.json ]; then
            echo "key=verify-failures-$(sha256sum .cache/verify-failures.json | cut -c1-16)" >>"${GITHUB_OUTPUT}"
          fi

      - uses: actions/cache/save@v6
        if: always() && steps.failures-key.outputs.key != '' && steps.failures-key.outputs.key != steps.failures.outputs.cache-matched-key
        with:
          path: .cache/verify-failures.json
          key: ${{ steps.failures-key.outputs.key }}

      # The trusted comment is fixed for a given updated_at and Ed25519 is
      # deterministic, so an unchanged keyring gets the same signature.
      - name: Sign v1/partners.json
        env:
          PLUGIN_SIGNING_KEY: ${{ secrets.PLUGIN_SIGNING_KEY }}
          PLUGIN_SIGNING_KEY_PASSWORD: ${{ secrets.PLUGIN_SIGNING_KEY_PASSWORD }}
          PLUGIN_SIGNING_PUBLIC_KEY: ${{ vars.PLUGIN_SIGNING_PUBLIC_KEY }}
        run: |
          set -euo pipefail
          if [ -z "${PLUGIN_SIGNING_KEY}" ]; then
            echo "::warning title=Partner keyring not signed::PLUGIN_SIGNING_KEY is not set. Hosts ignore a keyring without a valid signature."
            exit 0
          fi
          sudo apt-get update -qq && sudo apt-get install -y -qq minisign
          key_file="${RUNNER_TEMP}/plugin-signing.key"
          trap 'rm -f "${key_file}"' EXIT
          (umask 077 && printf '%s\n' "${PLUGIN_SIGNING_KEY}" >"${key_file}")
          updated_at=$(node -p "JSON.parse(require('fs').readFileSync('dist/v1/partners.json', 'utf8')).updated_at")
          # minisign reads the password from stdin, a key made with -W has none.
          printf '%s\n' "${PLUGIN_SIGNING_KEY_PASSWORD}" \
            | minisign -S -s "${key_file}" -m dist/v1/partners.json -x dist/v1/partners.json.minisig \
                -t "nginx-ui partner keyring ${updated_at}" >/dev/null
          public_key=$(printf '%s\n' "${PLUGIN_SIGNING_PUBLIC_KEY}" | grep -Ev '^untrusted comment:' | tr -d '[:space:]')
          if [ -n "${public_key}" ]; then
            minisign -V -q -m dist/v1/partners.json -x dist/v1/partners.json.minisig -P "${public_key}"
            echo "v1/partners.json.minisig verifies against PLUGIN_SIGNING_PUBLIC_KEY"
          fi

      - id: deploy
        name: Deploy to Cloudflare Pages
        if: steps.build.outputs.changed == 'true' || github.event_name != 'schedule'
        env:
          CLOUDFLARE_API_TOKEN: ${{ secrets.CLOUDFLARE_API_TOKEN }}
          CLOUDFLARE_ACCOUNT_ID: ${{ secrets.CLOUDFLARE_ACCOUNT_ID }}
          PAGES_PROJECT: ${{ vars.CLOUDFLARE_PAGES_PROJECT || 'nginx-ui-plugins' }}
        run: |
          set -euo pipefail
          if [ -z "${CLOUDFLARE_API_TOKEN}" ] || [ -z "${CLOUDFLARE_ACCOUNT_ID}" ]; then
            echo "::warning title=Not deployed::CLOUDFLARE_API_TOKEN or CLOUDFLARE_ACCOUNT_ID is not set, the site is kept as an artifact only."
            exit 0
          fi
          npx --yes wrangler@4 pages deploy dist --project-name "${PAGES_PROJECT}" --branch main --commit-hash "${GITHUB_SHA}"

      - name: Close the submission
        if: github.event_name == 'push' && steps.deploy.outcome == 'success'
        uses: actions/github-script@v9
        env:
          MESSAGE: ${{ github.event.head_commit.message }}
          SITE: ${{ vars.CATALOG_URL || 'https://plugins.nginxui.com' }}
        with:
          script: |
            const message = process.env.MESSAGE ?? ''
            const id = message.match(/^feat\(plugins\): list ([a-z0-9.-]+)$/m)?.[1]
            const issue = Number(message.match(/^Submitted by @\S+ in #(\d+)$/m)?.[1])
            if (!id || !issue)
              return
            const index = require('node:fs').readFileSync('dist/v1/index.json', 'utf8')
            const listed = JSON.parse(index).plugins.find(plugin => plugin.id === id)
            const where = { ...context.repo, issue_number: issue }
            if (!listed?.releases?.length) {
              await github.rest.issues.createComment({ ...where, body: `The entry of \`${id}\` is in the catalog sources, but no release of it verified in this deploy, so it is not listed yet. A maintainer will follow up.` })
              return
            }
            const page = `${process.env.SITE.replace(/\/+$/, '')}/plugins/${id}/`
            await github.rest.issues.createComment({ ...where, body: `Listed: ${page}\n\nNew releases are listed on their own from now on, and the listing follows the newest stable release.` })
            // From now on the issue follows the listing, submit-issue.yml leaves it alone.
            await github.rest.issues.addLabels({ ...where, labels: ['listed'] })
            await github.rest.issues.update({ ...where, state: 'closed', state_reason: 'completed' })

      - name: Ask for name reviews
        if: steps.build.outcome == 'success' && (steps.deploy.outcome == 'success' || steps.deploy.outcome == 'skipped')
        uses: actions/github-script@v9
        with:
          script: |
            const fs = require('node:fs')
            const { syncNameReviews } = await import(`${process.env.GITHUB_WORKSPACE}/scripts/ci/name-review.mjs`)
            const pending = JSON.parse(fs.readFileSync('pending-names.json', 'utf8'))
            const entries = new Map(fs.readdirSync('plugins').filter(file => file.endsWith('.json'))
              .map(file => JSON.parse(fs.readFileSync(`plugins/${file}`, 'utf8'))).map(entry => [entry.id, entry]))
            for (const line of await syncNameReviews({ github, repo: context.repo, pending, entries }))
              core.info(line)

      - uses: actions/upload-artifact@v7
        with:
          name: site
          path: dist
          retention-days: 7